🟡 CVE-2026-84869

CVE-2026-84869 is a critical missing-authorization flaw in the ConnectWise ScreenConnect CLIENT (not the server) that allows a remote session guest to transfer and execute arbitrary files on the host machine without host confirmation. The vulnerability is explicitly confirmed to affect only the client-side agent, not the ScreenConnect server infrastructure. Despite CISA KEV listing and a CVSS 9.9, this is a client-side execution vulnerability (T1203) triggered during an active session rather than a direct public-facing server exploit (T1190), though it poses extreme risk to managed endpoints.

← Back to Overview
MEDIUM_RISK
Risk Level
9.9
CVSS Score
NETWORK
Attack Vector
Execution
ATT&CK Tactic
T1203 — Exploitation for Client Execution
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-09-08

Added to CISA KEV: 2026-09-11 3 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-84869 is a critical vulnerability (CVSS 9.9) in the ConnectWise ScreenConnect client resulting from improper privilege management and missing authorization. This flaw permits an attacker to transfer and execute arbitrary files on a host machine during an active remote session without requiring any host confirmation or authorization [3][6]. Because this vulnerability facilitates unauthorized Remote Code Execution (RCE) on client machines, it poses a severe threat to the confidentiality, integrity, and availability of compromised systems [1].

Exploitation

  • Active Exploitation: CISA has confirmed that this vulnerability is being actively exploited in the wild [2][7].
  • Threat Actors/Campaigns: Specific threat actor attribution is currently not widely publicized, but the inclusion of the vulnerability in the CISA Known Exploited Vulnerabilities (KEV) catalog indicates high-priority targeting [2].
  • Proof-of-Concept/Tools: Public proof-of-concept exploits or automated attack tools are implied by the active exploitation status, necessitating immediate defensive action.
  • Attack Prerequisites: Exploitation requires an active remote session between the client and the attacker, and the attacker must be able to initiate unauthorized file transfer/execution actions within that session [1][4].

Affected Products & Patches

  • Affected Versions: All versions of ConnectWise ScreenConnect prior to the release of the security update are affected [2].
  • Patch/Hotfix: ConnectWise has released a security update to remediate the vulnerability; organizations are urged to apply these patches immediately [5].
  • Mitigations: In addition to patching, administrators should monitor session logs for suspicious file transfer activity or unauthorized executions initiated during remote support sessions.

Impact

  • Access/Capability: Successful exploitation grants an attacker the ability to achieve Remote Code Execution (RCE) on the target host machine, effectively bypassing standard host-side authorizations and controls [1][4].
  • Business Risk: For internet-facing deployments, this vulnerability represents an extreme risk, as it can be leveraged to gain initial access, deploy ransomware, or exfiltrate sensitive data from managed endpoints, potentially impacting an entire organization's infrastructure [1].

Sources

  1. CVE-2026-84869 - Vulnerability Details - OpenCVE

    A flaw in the ScreenConnect client permits files that are transferred through an active remote session to be executed without any host confirmation or authorization. The vulnerability creates the ability for an attacker to run arbitrary code on the client machine, compromising confidentiality, integ…

  2. CVE-2026-84869 · ConnectWise · CVSS 9.5 · CISA KEV · CVE Brief Analyst ...

    CVE-2026-84869 9.5 CISA KEV ConnectWise · ScreenConnect A missing authorization flaw in the ScreenConnect client allows unauthorized file transfer and execution during active remote sessions. Quick facts CVSS score 9.5 (Critical) CISA KEV Listed (confirmed active exploitation) Fix available Yes (CVE…

  3. CVE-2026-84869 — ConnectWise ScreenConnect Improper Privilege ...

    ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.

  4. ConnectWise Releases Security Update for ScreenConnect

    ConnectWise has released a security update to address a vulnerability in ConnectWise ScreenConnect. CVE-2026-84869 - Missing Authorisation / Improper Privilege Management vulnerability - CVSS v3.1 score: 9.9 ConnectWise rate this vulnerability as "1 High", which indicates it is either being targeted…

  5. CVE-2026-84869: ScreenConnect Guest File Exec

    ScreenConnect Client auth bypass in file-transfer actions grants guest users RCE on host machines via unauthorized file execution without ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed